EU May Forbid the Transfer of Personal Data To the US

An anonymous reader writes: As the Snowden revelations have shown, personal data stored in the United States of America is not protected from the US government, be it through warrantless eavesdropping or national security letters. In light of this, the general attorney for the Court of Justice of the European Union has just issued an opinion requiring the US to be removed from the list of "safe harbors", where the transfer of personal data of European citizens is permitted. If the court follows his opinion, the change will have deep impact in the operations of large transnational Internet companies, between a US government that wants to keep on spying, and European authorities that will punish them if they let it happen.

Comments

The US needs a serious spanking

[msobkow]

The US needs to wake up to the fact that it doesn't set policy for the world, and that other jurisdictions have their own laws and regulations that US companies have to abide by if they want to do business there.

Enough with jackboot "treaties" that the US doesn't even try to abide by after signing them. :(

Re:The US needs a serious spanking

[msobkow]

No one is making claims under the agreement. What they are saying is that the US does not abide by the terms of the agreement, so the agreement should be nullified.

This isn't a decision being made by courts; it's a decision being made by the government. Totally different ballgame.

The US does not get to dictate law to foreign nations, no matter how much they'd like to.

Re:The US needs a serious spanking

[Anonymous Coward]

Actually, what you're saying is false. The case stems from a complaint brought by an Austrian citizen against Facebook. That constitutes bringing a claim against a US organization. The Irish Data Protection Commissioner ruled against the claim, so it was appealed to the European Court of Justice.

And, let's be clear, the EU is actually the one trying to dictate the law to the US. Schrems' lawyer was quoted as saying, "If the United States doesn't change its laws in order to guarantee a minimum of data protection to European citizens, U.S. companies will have to process their data in the EU."

I despise mass surveillance like what's going on in the US. I actually think EU citizens have a right to be angry that their data is being handed over to the US en masse. I just don't think the treaty is being followed by the EU and that the EU is actually trying to tell the US what US laws should be. It doesn't necessarily mean they're wrong to despise the mass surveillance.

Re:The US needs a serious spanking

[Lonewolf666]

The EU is trying to dictate the law to companies that are doing business in Europe, not against the US government or congress. Which every country does on its territory. Note that the case is against Facebook, not the US government.

Some of these companies happen to be US companies. Who may be in a bind soon, as the European Court of Justice is likely to invalidate the Safe Harbor Agreement, as it usually follows the advice of its general attorney. If that happens, said US companies are no longer allowed to store data of EU citizens outside the EU, but at the same time they may be told by the US via national security letter to hand over those data.

If both the US and the EU stay adamant, companies like Facebook may have to choose between doing business in the US or in Europe.

Re: The US needs a serious spanking

[Anonymous Coward]

What handouts? Maybe you should feed your own starving citizens before even dreaming about some handouts? US "handouts" always come with strings attached, nobody in their right mind should touch them. If you want to build your country in the image of 1984 please do, but don't be surprised when the rest of thwe world refuses to use it as a manual on society building.

Re:The US needs a serious spanking

[Sique]

Actually, what you're saying is false. The case stems from a complaint brought by an Austrian citizen against Facebook. That constitutes bringing a claim against a US organization. The Irish Data Protection Commissioner ruled against the claim, so it was appealed to the European Court of Justice.

That might be the origin, but that's not the question the Attorney General issued an opinion about. The Irish High Court refused to hear a claim about Facebook's transfer of data and referred to the Safe Harbour treaty, and thus there was the question to the European High Court if the Irish High Court has to consider if the actual conditions of the Safe Harbour provisions were met. And now the Attorney General opinionated that the U.S. does not met the the regulations for the Safe Harbour treaty because European citizens have no legal recourse against the wholesale spying performed by the NSA and other organisations in the U.S.. The NSA spying was called unspecific and without clear goal and thus in violation of the privacy rights of European citizens. This is the first time that an European institution actually took the Snowden allegations as fact (until now most courts opinionated that the allegations have not been proven yet), and thus issued a statement that the U.S. is not adhering to the provisions and thus the European Commission can't declare the U.S. a safe harbour, thus all treaties with the U.S. about data protections are void.

Re:The US needs a serious spanking

[Anonymous Coward]

Let them handle Putin, ISIS, and the refugees, all over on their side of the world. Not the US's problem.

You know that the rise of ISIS and the refugee crisis is the result of the US conquest in the middle east, right?
What your are calling "Not the US's problem." is the consequences of US politics a decade ago. The US has been criticized for it but never took responsibility for the shit that was stirred up.
Dealing with the refugees could be as easy as building a wall like the one Trump suggested towards the Mexican borders, but that is not very humanitarian.

The insanity that is Putin is the result of the cold war. I'm a bit too young to remember what led to what and how people in "intelligence"-agencies ended up that way so I can't really point out how he ended up like that. The only thing I can say for sure is that he doesn't act differently from people who work in similar agencies in the west.
From a pragmatic standpoint it could be useful to have paranoid people around to let them think about all the possible threats, but it is very unwise to take their fears at face value or to put them in a position of power.

Re: The US needs a serious spanking

[Anonymous Coward]

The US infrastructure is ageing.... badly.
The US debt is increasing

The US is no longer the worlds largest, that goes to China with India and Brazil rising

The only things the US is No1 in is military spending and prison population.

All other metrics the US barely makes it into the top 10, if ever.
Education, Welfare, freedom of the press, Honesty, life expectancy, health, racial harmony, corruption.

Re:The US needs a serious spanking

[bug1]

The US needs to wake up to the fact that it doesn't set policy for the world,and that other jurisdictions have their own laws and regulations

The US government happily violates its own constitution. Its expecting too much for any nation to have more respect for foreign laws than their own.

Re:The US needs a serious spanking

[viperidaenz]

Isn't Facebook an Irish company?

Re:The US needs a serious spanking

[Anonymous Coward]

Actually, the end of the Cold War was expedited considerably because Bush Sr and James Baker promised Gorbachev they would not expand NATO eastward. "Not one inch" was the phrase at the time.

Now NATO have added basically all of eastern Europe, and are trying to incorporate Ukraine.

Doesn't make Putin a good guy, he patently is not. But without this context it is not actually possible to understand the situation.

Consider how the US would react if Russia were spending billions toward unconstitutional regime change in Mexico with the aim of installing a virulently anti-american regime there? 'Cause that is pretty much what happened in Ukraine.

Re:The US needs a serious spanking

[Richard_at_work]

With all due respect, its not down to the US government to accept that US companies have to obey foreign laws - the conflict is something that solely needs to be handled by the companies in question, they have to decide how they can follow both sets of laws if required to.

A US company operating in a foreign country doesn't suddenly fall outside US jurisdiction - if they do find themselves in conflict between the laws of the country they (or their owning umbrella company) are incorporated in and the laws of the country they are doing business in, then its up to the company to decide whether they can resolve that or leave one of the jurisdictions (stop doing business in that country or change the country of incorporation or ownership).

The EU passing laws requiring foreign companies to solely follow EU jurisdiction doesn't solve anything - it doesn't stop the companies being in the jurisdiction of their home country, all it does is create further conflict.

The only thing that can satisfy this situation are completely, entirely and utterly unconnected companies - Amazon SARL having no ownership or connection to Amazon.com Inc. If there is any ownership or similar connection between the two companies, its entirely legitimate for Amazon.com Inc's legal jurisdiction to cascade down the chain of ownership.

Re:The US needs a serious spanking

[gl4ss]

if facebook had no european operations it would not be having any problems, as the data would already be in USA.

but they're doing business and hosting in the EU, so there's that. nothing forcing them to try to prosecute in the usa.

bottom line is that USA isn't complying.

Re:The US needs a serious spanking

[The Grassy Knoll]

companies like Facebook may have to choose between doing business in the US or in Europe.

Win Win for Europeans!

Re: The US needs a serious spanking

[nospam007]

"So what? We can still kill your economy and a sizeable part of your population without breaking a sweat. "

Only if the Chinese loan you the money to do it.

Re:Weigh it up.

[Anonymous Coward]

Or

US corporation stay within the USA, missing out on doing business with 96% of the worlds population.

At one point the USA made up about 60% of the worlds GDP, that meant doing business with the US.

Now the US is about 1/3 of the worlds GDP, meaning more money can be made dealing with everyone else.

The US is no longer able to dictate to the world, and that scares US politicians shitless, they don't know how to behave when not in charge.

Re:Weigh it up.

[msobkow]

This.

There is no "right" for US corporations to participate in foreign markets. If they don't want to abide by the terms of a foreign nation's laws, they're free not to do business there.

They are not free to impose US law on those nations.

Re:BS article summary

[Schmorgluck]

Nope, it's absolutely necessary for US companies to either be certified under the International Safe Harbor Privacy Principles, or otherwise demonstrate to the EU that they abide by those principles, in order to be allowed to transfer personal data to the US. Any other scenario would be a violation of the Data Protection Directive, because the USA doesn't provide adequate level of protection, and never has.

The problem is that the certification process is easier, and totally unreliable, especially when it comes to big fishes. The FTC hasn't shown any willingness to make any effort to enforce it significantly (FTC: "Are you complying to the Safe Harbor Principles?" Big Data: "Yes we are." FTC: "Good. Here's your certification."), making it de facto a vast scam.

Re:BS article summary

[Schmorgluck]

Nope, it's illegal. The USA don't have sufficient data protection laws, therefore the transfer of personal data from the EU to the USA is prohibited by default (article 57 of 95/46/EC), with some exceptions (article 58 of 95/46/EC), unless particular measures are taken (article 59 of 95/46/EC).

It's been obvious for a long time that

[Maritz]

The US isn't a safe place to store anyone's personal data. Never has been. The subtext/attitude has always been 'anything you give us is ours to do with as we please'. The irony here sadly is that "EU" includes the UK (for the time being at least) and here the GHCQ do whatever they like. There is no meaningful oversight nor will there ever be.

Re:Weigh it up.

[a_n_d_e_r_s]

Won't help. As long as they are US companies the US Courts think they can force them to divulge information stored in EU.

From an actual court case still active against Microsoft.